La&t month we cave you a lot to think about and to experiment with. 
Let's start with something simple this month. The only requirement 
for this program is a little detective work. 


The program is UP'N DOWN (TM), Copyright Sega, 1984. 

TYPE OF PROTECTION: The disk contains an error 23 on tracks 31-35. 

The program will check one of these tracks for this error and run if 
present. 

HOW TO COPY: Hake a copy of the disk and place these errors, or make 
a copy with a nibble copy program that will place the errors for you. 

HOW TO MAKE A WORKING COPY WITHOUT ERRORS: 

1) . Hake a copy of the program without errors on the disk. 

2) . The program called BOOT contains the error checking routine. 

Since this is an auto boot, it will be difficult to examine the 
code without loading it to another area of memory. Load and 
execute LOMON with SYS 32768. Reset your computer with G FCE2. 
Now load the 1st boot into BASIC with LOAD 'AUTOLOAD8. 
Re-activate LOHON with SYS 32768. This will defeat the auto load 
and allow us to examine the code. Disassemble the code a S0801. 

It would appear from the program code that there is nothing 
unusual about the code. Using the D command at 30868, you will 
find a JHP S4700. This la the starting address for another 
program on the disk called 'LOADER'. Further on, we will find a 
JHP S414F, which is a jump to 'never-never-land'. This leads us 
to believe that once the program has found its error, it will 
continue with normal program execution, by loading and executing 
the 'LOADER' program. Let's give it a try. 

3) . LOAD 'LOADER',8,1 from the copy disk. Now all we need do is 

convert this program's starting address to decimal. This will 
give us an address of 18176. With the program in memory, type 
SYS18176 followed by a return. 

4) . YOU'RE DONE. 

Remember no matter how cryptic the code may seem, the result is 
always the same. Don't be afraid, to experiment. You can't hurt your 
computer, but you will save your disk drive. 
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The prooram i s COHAN^S TOWER, Copyright 1983, by Cate^ost, Inc., 

Copyr J ght 198 3'7 Panda, Licensed by Datamcst. 

TYPE OF PROTECTION: This program will check track 02/sector 09 for an 
error 23 and track 02/sector 10 for an error 20. If present the 
program will load normally. 

HOW To COPY: hake a copy of the disk and place an error 23 at track 
02/3ector 09 and an error 22 at track 02/sector 10. You may also use 
one of the newer copy programs that will place the errors for you. 

HOW TO HAKE A WORKING COPY WITHOUT ERRORS ON THE DISK: 

1) . Load the program from the original disk with LOAD' :•' , 8,1. 

2) . Once the program is running, insert your cartridge-based machine 

language monitor with the cartridge switch off. You may also use 
the Cardo 5 expansion board with the left switch on. Reset your 
computer with the cartridge switch off. 

3) . You should now have the familiar blue screen, showing 30719 BASIC 

BYTES FREE. 

4) . Now turn on your cartridge switch (Cardco - right switch) and hit 

the RESTORE key. You should now be in your cartridge monitor. 

5) . Since we had to use the 'back door' for this program, we must now 

find an entry point. The best place to start is a store (STA) to 
border (D020) or background (D021) color. We will use the hunt 
command to begin our search. H 0800 7FFF 8D 20 DO and press 
return. Six memory locations will be returned by the computer. 

6) . We'll use the first location 90918. When we scroll through this 

section, we find stores to border and background. This spot looks 
promising. Let's give it a try. 

7) . Since we have to load (LDA> something before we can store (STA) 

it, we will begin at S0916. Use G 0916 to execute this section. 

As you can see, we are back in the game. 

8) . We will now save out the code to a formatted disk. Repeat steps 

1-4 to regain control of the program. Once you are back in the 
cartridge monitor, save the code with S 'COHAN'S 
TOWER',08,0800,7FFF. To utilize the program, LOAD 'COHAN'S 
TOWER',6,1 and activate with SYS2316 (HEX 0916), or write a boot 
program to activate the program for you. 

9) . YOU'RE DONE. 
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Let's dc a iit*le r>cre investigating with this prograw. Repeat steps 
1-4 with t^.e orlginsi disk. Once you are in the cartridge monitor, 
load end evecite HIMON, through ttie monitor with, G COCO. Turn ofl 
your cartridge switch and remove the cartridge monitor. Using the I 
command, scroll through the code at S8000. You will see a CEuSO. This 
is usually the first place we look for an entry point. This usually 
means that the program will emulate a cartridge start. This is a 
CBM80 with a twist. As you have learned from the P.P.M. and the 
NEWSLETTER, the warm-start vectors are located at 8002 and 8003. This 
would make our starting address S8009. Let's execute this code with a 
G 8009. Now reset you computer^ as described, and examine the code 
with the 1 command. As you can see, there is nothing left to 
interpret. Our program code has been replaced with BRK's. This was 
the purpose of the code at S8000. 

NOTE: DON'T GIVE UP AFTER ONE DEFEAT! VICTORY KAY ONLY EE A FEW BYTES 

away . 


The program is ON -COURT TENNIS, Copyright 1984, Gamester . 

TYPE OF PROTECTION: This program places an error 20 on trac)-.s 1-3. 

Tbe program will check two tad blocks and one good one. If the proper 
values are returned, the boot program will load the main file and 
execute properly. (Notice that this program will check two (21 bad 
blocks!! They make your read/write head beat twice against the end 
stop. Can you believe that?) 

HOW TO COPY: Make a copy of the disk and place an error 20 on tracks 
1-3, or use a copy program that will place the errors for you. 

HOW TO MAKE A WORKING COPY WITHOUT ERRORS ON THE DISK: 

1) . File copy the main program called 'FILE' to a formatted disk. 

2) . When we take a look at the loader program (TENNIS) through a 

track and sector editor (track 19/0), we find the loading address 
to be soiOO. This is the STACK. The stack is located in memory 
from SOIOO to SOIFF. The programmer is filling the stack with the 
address for the actual area of execution, which is S0203. This is 
determined by the fact that we find a repeated pattern of 02's in 
the disassembled boot. When the loading address (»0202) is pulled 
off the stack, it will be placed in the program counter and then 
incremented by one. This will make the starting address S0203. 
This is a nice form of protection. At S0203, we will find a jump 
(JMP) to 0800, which indicates that something will be happening 
there. The boot code is encripted on the disk and will be altered 
when it is brought into memory. This will make it Impossible to 
alter the code on the disk. Since we cannot alter this program on 
the disk, we will have to go about it another way. 

3) . Load the program from the original disk with, LOAD ':»',8,1. 

Watch the disk drive error light. When the light begins to blink, 
reset your computer. This gives the boot pregram enough ti"'e to 
decode and expose the error checking routine. 
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Lead and exe-JCte LG MON with SYS 327^9. Tisassep-ble the code 
beg)nnlnq at S0800. As you can see, we now- have a working loader. 
At SG8C5, we find a CMr^'932. This is the cherk for the bad block. 
Later an the code you will find a CMF<r£30, whach is the check for 
the good block. Using the M cesaand, change £08C6 to a 30. 

5i. Ve will now save the altered code to our forfratted disk with, S 
'TENNIS',08,0800,0A41. 

6) . The only thing left to do is to find an entry point. Another good 

place to try an entry point is at a ju»p instruction (JMP). When 
we disassemble the code again at S0800, we find the first JMP Is 
to S0908. With the disk containing our two files in the drive, we 
will try a G SC908. That's all there is to it. 

7) . To utilize this program, LOAD 'TENNIS',8,1 and execute with SYS 

2312 (HEX 0908) . 

8) . YOU'RE DONE. 


You will find auto boots described in far greater detail in the 
PROGRAM PROTECTION MANUAL VOLUME II. As stated, the stack is located 
in memory from sOlOO to SOIFF. When an address is pulled off the 
stack it IS placed in the program counter. The program counter is a 
IG-bit register, which contains the address of the next command to be 

executed. Once the program counter gets its address from memory, it 
is incremented by one, pointing to the next memory location to 
execute. Through this boot, 90202 will be placed in the program 
counter. When Incremented, this address becomes S0203. At this 
location, we find a jump (JMP) to S0800. It is here that we find the 
program protection scheme. 

Always check the starting address for an auto boot program, through a 
track and sector editor. This can save you a lot of time. If you do 
not have a track and sector editor that contains a monitor feature, 
just change the starting address of the program to an area of memory 
that may be examined through one of your monitors. Try it with this 
program. 

Go to track 19/0 on the original disk and change the 01 to a Cl. The 
program will now locate to SClOO and may be examined through LOMON. 

We chose programs for the NEWSLETTER that illustrate the current 
trends in program protection. Keep track of each new technique you 
learn and apply them to other protected programs. If one technique 
doesn'* work, try another. 

If you find you have a different version of the program than the one 
described, don't throw in the towel. The basic technique is there. 

You may just need a different entry point. Get out your memory map 
and analyze the code in that area. All you can lose is a little time, 
but you may gain a great deal of knowledge. 
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AN EDITORIAL 


THE BIGGEST SOFTWARE PIRATE OF THEM ALL^ 

As I see it, anyone who copies a copyrighted for distribution, sale, trade 
or unauthorized use without paying the fair value for the program is a 
pirate. 

We all know ths local fellow that can 'break' just about.any protection 
scheme. Not only can he break the program, he can do it in a matter of 
minutes.'Th1s guy ia a 'pro'. A real professional, the guy will break the 
program, but he doesn't pass it around. He doesn't sell or give away any of 
his broken treasures. Although he does let a few of his best friends 
'borrow' the broken copies of the software, he breaks the program miostly 
for the challangel! Is this the biggest software pirate? 

Then we all know another guy. This one is just as good as the first. He can 
break a program and do a first rate job of it. This fella is a little 
'friendlier' than the first. He will let others 'borrow' the broken copies 
of a program. Sometimes he will even copy these broken programs for others 
(illegally of course). This second fellow, is he the biggest software 
pirate?? 

I'm sure we all know of still another guy (or gal). This one is better at 
breaking programs than either of the first two. An expert at program 
protection, but not quite a professional. See, this is the guy that sells 
or distributes his 'pirated' software. You will find him at swap meets, 
flea markets and even some user groups. This person, the one that Illegally 
sella or distributes pirated software, is this the biggest pirate??? 

Think back now, who is really stealing from the programmer? Who is taking 
large sums of money right from the programmer's pocket? Remember, the 
programmer is the one who created the program, he is the one that put many 
hours of sweat and toil into his creation. Now, who is it that is really 
ripping off the author of the program?? Who is really the BIGGEST pirate of 
them all???? 

NONE OF THE ABOVE!! 

Anyone who makes unauthorized copies of a copyrighted program is violating 
the law. They are all 'pirates', what they are doing is illegal. IT IS 
ILLEGAL TO SELL OR DISTRIBUTE UNAUTHORIZED COPIES OF A COPYRIGHTED 
PROGRRAH! ! ! 

NOW LET'S LOOK AT THE BIGGEST SOFTWARE PIRATE OF ALL!! 

The unscrupulous software publisher is by far the BIGGEST software pirate 
of them all. Most software publishers are legitimate and honest. They enter 
into fair contracts with the authors/writers of the software. They pay fair 
and equitable royalties and they pay on time. For the most part the 
software Industry, as a whole, is honest and honorable. 

It has come to our attention that a number of software authors are legally 
being cheated out of their royalties by a few unscrupulous software 
publishers (and I must emphisize a few). Now, let's look at the other 
aspects of the biggest software pirates. The biggest software pirates can 
legally withhold the royalties from the authors of a software program. The 
biggest software pirate can sell and distribute someone else's copyrighted 
work without paying the author one cent in royalties. The biggest software 
pirate can intimidate and force the software author into accepting less 
that fair compensation for his services. The biggest software pirate can 





t- ^^e ncvice software author unfair or unreasonable terns in the 
-ontJact. Ue know of nany software authors who were so eager to get their 
software to rarket that they are forced to settled for a less t..an fair 
royalty percentage, then the company refuses to pay ANY royalties!!! 

H-w dooa the unscrupulous software publishing company get away with these 
of intustice’ Quite simply and quite legally, I must say - they just 
file bankrupcy. Pretty slick isn't it. The author spends months and months 
of his life writing a program. He doesn't receive a penny for all hia 
^abor All of this work is done baised upon soiie publishers promise of 
;oy^Uy LcL. Th. publisher .ecureb . contract with the enthor. Thla 
contract usually gives the publisher a reasonable time to get the product 
to rarket (3-6 months). Then the contract usually states that the publisher 
has 1-2 months afte^ .marketing begins BEFORE any royalties have to be paid. 
Then the 'zinger'; the publisher inserted a clause in the 
gives them 3-6 more months to correct a 'breach of contract .A breach 
occurs when the publisher refuses to pay the author his ^^^^®® 
are due. What this means is, once the publisher refuses o pay 
his due royalties, the publisher has another 3-6 months to sell the 
author's program before the author may sue to recover the monies due him. 
Now the software author sues the publisher, the publisher files bankrupcy 
and the software author gets nothing for his efforts. 

The process starts all over for the software author. He looks for another 
publisher for his program. He enters into new contracts and hopefully 
will receive sore conipensa t i on for all his efforts. 

It is a very sad story for the software author. He has been legally ripped 
off. Sore publishing company has LEGALLY taken roney that e ongs o 
software author. Money that the software author will probably never see. 

Re.ember that this little story takes place totally within the confines of 
the law. Totally legal, but certainly not ethical. It is beyon me ow 
treatment can be considered legal. 

Don't forget what we told you earlier. You are violating federal law if 

make an unauthorized copy of a copyrighted ®® xw _£ ^ 

unscrupulous software publisher can get away withou pay g 
program anything. Keep this in mind the next time someone passes you a 
bootleg copy of a program or when you hear of another bankrupcy. 

If you should happen to 'borrow' a friend's copy of a program «nd you like 

it, buy one yourself! If you happen to run across a copy o a p , 

you like and use, support that company - buy their pro uc * 

software author when you buy those products that are *500 . en that 

software author can spend his time creating new and excl ng pro 

we all will benefit from. On the other hand, when the software author 
spends his time chasing pirates (big and small), we all suffer. 
. 

One last item, last month we told you about a copy program that made the 
claim: 'COPIES ALL SOFTWARE EXCEPT ITSELF... SATISFACTION GUARANTEED... 
return for refund within 10 DAYS IF NOT SATISFIED'. The copy program would 
not copy very much software. I was not satisfied; in fact I was 
disappointed in the product's performance. Well, I returned my copy within 
10 days after it arrived and they refused to refund my money. Not only 
that, they returned my disk with postage due!!! So much for guarantees.... 


to get off 
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WORKING 'INSIDE' THE DISK DRIVE 


In order to work inside the disk drive, it will be necessary to understand 
how to use an 'essential' tool. The tool that we are speeklng of is called 
'DRVMCNE4' by STARPOINT SOFTWARE (the DISECTOR people). DRVM0NE4 is probably 
the woat powerful tool available for working inside the disk drive. DRVh!CK64 
is also one of the post overlooked tools around. DRVM0N64 is copyrighted by 
STARPOINT software and contained on the DISCTOR disk. One interesting fact 
about th’i* program is that it is not copyprotected. 

Two other items that you should have in your 'tool kit' are the books INSIDE 
COMMODORE DOS by Richard Immers and Gerald Nuefeld and THE ANATOMY OF THE 
1541 DISK DRIVE by Abacus. With these two books and DRVM0N64 there is 
virtully nothing that cannot be accomplished inside the 1541. Inside 
Commodore DOS is an excellent book, well written, easy to understand and by 
far the most comprehensive book on the disk drive. 

HOW TO USE DRVMCN&4 

DRVH0N64 is a ML monitor that will work equally well in the disk drive or the 
computer. It is possible to transfer data between the disk drive and the 
computer. It is possible to assemble or disassemble code in the computer or 
directly in the drive's memory. As a matter of fact, all of the ML monitor 
functions that are available in the computer are available in the drive with 
DRVM0N64. 

If you don't currently have a copy of the DRVMCN64 we would strongly suggest 
that you obtain one. Since it is a copyrighted program we can not supply you 
with a copy of it. If you already own DRVM0N64 we suggest that you get out 
your copy of the DISECTOR manual and read the DRVM0N64 instructions before 
proceeding any further. 

Load and execute the version of DRVM0N64 that resides a 49152 (SCOOO). This 
the version of the program that we will use for our discussion. When DRV'M0N64 
is first executed the monitor will be working in the computer's memory. To 
use the monitor in the disk drive simply type 08 (0 the letter, not 0 the 
number) then RETURN. You will notice that there is a '3' (bracket sign) next 
to the cursor, this indicates that you are in the drives memory. Let's try 
some real easy commands. Type 'M 0000 003F' (RETURN). The code that you see 
is the actual code from the disk drives memory starting at SOOOO and ending 
at ®003F. You may also use the other commands (A, D, F, G, etc.) when you are 
in the disk drive. Try the following command 'D FCAA' (RETURN), you will now 
see a portion of the ROM memory disassembled. DRVM0N64 is fast, it is easy to 
use end it is probably the beat tool for examining the disk drives memory. 

For now we will concentrate on one area of the drives memory, the Job command 
queue #0 located at *0000 and the track and sector for buffer #0 located at 
C0006 (track) and S0OO7 (sector). The disk drive will use these locations to 
perform many of its tasks. When the disk drive reads a block of data from the 
disk it will use the Job command queue located at *0000 to perform this 
function. This location is checked by the disk drive through its interrupt 
routine (IPO). If the proper value (command code) is stored at location SOOOO 
the drive will execute the function that corresponds the command code. 
Following is a table that describes the the command codes and their meanings. 
All values are in hex: 










80 

90 

AO 

BO 

B8 

CO 

DO 

EO 

UP TO SPEED 

EXECUTED': 


READ A SECTOR 

WRITE A SECTOR 

VERIFY A SECTOR 

SEEK A TRACK (ANY SECTOR) 

SEEK A TRACK & SECTOR 

BUMP - FIND TRACK 1 

JUMP TO ML PROGRAM IN BUFFER 

EXECUTE CODE IN BUFFER - FIRST THE DRIVE. WILL BRING THE DISK 
AND SEEK THE PROPER TRACK, THEN THE CODE IN THE BUFFER WILL BE 


The track end sector number should be stored at locations $0006 and S0007 
respectively prior to storing the cc»»end code at location $0000. When we use 
DRVM0N64 it is possible to set all the values at the same time and let the 
program do the rest for us. So much for theory, let's have some fun! Format a 
disk and leave it in the disk drive. This way we can have something to work 
with. Do not experiment with a valuable disk. We will use the M command of 
DRVM0N64 to perform the following experiments. For the sake of clarity it may 
help to remove the cover of the disk drive and the metal shield. This will 
enable you to see the actual results (of the R/W head) that we are going to 
obtain. Type in the following lines directly next to the 1 (bracket sign). 

lei (RETURN) 

This will initialize the disk drive. DRVM0N64 also contains a built in DOS 
wedge. Now type in the following line. Don't add any extra spaces or data to 
this line. 

IF 0300 03FF 00 (RETURN) 

This command will fill data buffer 0 (located from $0300 to S03FF) with OO'a. 
This gives ue a freah work space. Next type in the following line. 

D:0000 80 00 00 OO (X) 00 01 05 (RETURN) 

Let'a examine the above line. The $80 (at location $0000) specifies read a 
block. The $01 (at location 60006) specifies the track number. The $05 (at 
location S0007) specifies the sector number. If everything went as expected 
the drive will come to life, the disk will start spinning, the head will move 
and track 1, sector 05 will be read into buffer O (located from 60300 to 
S03FF). Before wo examine the code from 60300 to 603FF let's be sure that the 
drive was able to properly read the data. To do this it will be necessary to 
examine the job command queue for an error message. After a command is 
procesmod by the drive, the DOS will store an error code back in the command 
code queue. The error codes are interpreted as follows: 

01 NO ERROR - JOB COMPLETED 

02 HEADER BLOCK NOT FOUND 

03 SYNC NOT FOUND 

04 DATA BL(X:K NOT FOUND 

05 DATA BLOCK CHECKSUM ERROR 

07 VERIFY ERROR (AFTEp WRITE) 

08 WRITE PROTECT ERROR DURING WRITE 

09 HEADER BLOCK CHECKSUM ERROR 

OA DATA BL(X:K TOO LONG 

OB ID MISMATCH ERROR 

10 BYTE DECODING ERROR 

Type 'M 0000 0007' (RETURN). We will now be able to examine the contents of 
location 60000 for the error message. If there waa no error the value of SOI 




: i ] 1 ■<=' 

e >. n e 
the 


C .? r. * i r, e 3 C ^ 

the p.rocer.re 
iTien>or> frc-K. 


o block tt=t 


locstiC'D SOOOO. If any other value 
staring with the '?!' coiMf.and. Use 
Sf<300 to S03FF. This is the area of 
was read. 


is contained there, 
the 'M' ccrrand to 
F^epory that contains 


N-w that y-'u car. read a nerval data block into remory let's go a little 
farther list by substituting a S90 at locaion SOOOO we can write the data at 
S0300-S03FF out to any sector. Try using the other coPPands to Verify, Seek 
or Bumo On word of caution though, if you use the JUMP or EXECUTE coir,rands 
be s'lre'that there is a valid ML routine at location S0300. If you don't have 
a valid ML routine located there the drive will lock up. A power power-off or 
a RESET will be required to restore your drive to norral. 

T+ nr+ nc^resoary to use a valid track or sector nurber at rerory locations 

ioooe rUS" TryLepe.tlng the .beve Procedure oith . treck number of S24 
It is possible to move the head to any track on the disk (1 to 
«rlnd retd'd.te fro. the dish. The det. thst will be reed .ust hsve been 
written in the standard 1541 format. Otherwise an error will be returned and 
data read will not be valid. It is interesting to note that the head will not 
'BUMP' when errors are encountered when using the job co»»and queue to 
execute direct copranda. Try removing your disk and execute the read coir.pand. 
The head will not BUMP when an error is encountered if we are directly 
executing the co»i*and. 


If you wish to use the EXECUTE coFPand it will be necessary to write your own 
ML read and write routines. With the use of these routine it is possible to 
read and write data to the disk ANYWHERE from track 1/2 to track 40 1/2. The 
routines necessary to perform these operations will be discussed in detail in 
the PROGRAM PROTECTION MANUAL VOLUME II. 

One other very interesting area in the disk drive's memory is the disk 
controller port B, location SICOO. Memory location SICOO is where we can 
control the stecrer motor, the drive motor and the density selection. Each 
bit of the byte at location SICOO has a special function. Following is a 
table that Illustrates the fuction of each bit 


BIT 

VALUE 

FUNCTION 


0 

SOI 

BITS 0 t 1 ARE CYCLED TO STEP 

1 

S02 

(MOVE) THE HEAD IN AND OUT 


2 

S04 

MOTOR ON AND OFF (1 BIT IS 

ON) 

3 

S08 

DRIVE BUSY LED (LIGHT) 


4 

SIO 

WRITE PROTECT DETECT 


5 

S20 

DENSITY SELECT 


6 

S40 

DENSITY SELECT 


7 

S80 

SYNC DETECT 


Let ' 3 

just try 

another little experiment. 

We 


contained at location SICOO. Be sure that the cover is removed from your 
drive so that ycu may see the half tracks. Initalize your drive (91) then 
type in the following line from DRVM0N64 
drive (1). 


Be sure you are working in the 


3M ICOO 1C07 RETURN) 

You will see thi*. the value contained a location SICOO is a SD2 (binary xllOl 
0010). Ey.ep 11'1 »•; the binary value we can see that bit 2 contains a 0. This 
means that the drive motor is off (remember bits are numbered from 0-7). If 
we want to turr rn the drive motor all we have to do is set bit 2 to the 
value C'f 1. *hi; will result in the binary value of x 1101 0110 (hex SD6). To 
store the vriue :f sLB in memory location SICOO use the following commar.c. 





D i C0<:.' Dto 


( FETUFN^ 


Th€ drive inotor will cere on and disk will spin. The disk will continue to 
?Fir. es long as bit nutter 2 of SICOO is set to a value of 1 (HEX SD6 = 

BINARY ’c 1101 01101. To turn the rnotor off move the cursor up to the D6 and 
rha^ge it to the value of D2 (then press RETURN). The motor will turn off. In 
order to move the head in half tracks it will be necessary to cycle the 0 & 1 
bits in the following fashion. First initalize the drive (@I). Then use the 
following command: 

0:1000 D6’' (RETURN) 

Move the cursor back up to the D6 and change the value to D7, then D4, then 
D5, then D6, then D7, then D4, then D5, then D6, etc. To move the head in 
half tracks all we have to do Is cycle bits 0 6. 1 of location SICOO. Use the 
following sequeuence of bit values 00, 01, 10 ,11, 00, 01, 10, 11, etc. Start 

with the appropriate bit pattern (10) and cycle through the others. Change 
only those bits that directly sffect the location of the head (bits 0 6. 1). 
The first D6 will just turn the drive motor on, the D7 will move the head 1/2 
track in, the D4 will again move the head 1/2 track in, etc. If you were to 
analyze the bit pattern used at location SICOO it will become apparent that 
all we are doing is cycling bits O & 1 to move the head. Conversely, if we 
wish to move the head out from track 18, we would do the following. 

Initialize the drive (PI) so that we start with the head at track 16. Type in 
the foilowing: 

OrlCDO D6 (RETURN) 

This will turn on the drive. Then move the cursor back up to the D6 and 
change the value to D5, then D4, then D7, then D6, then D5, then D4, then D7, 
then D6, etc. In order to move the head in the oppisite direction all we have 
to do is cycle bits O t 1 in the reverse order. 

The internal DOS of the disk drive will take care of cycling the bits to move 
the head during normal operation. The DOS will also perform the action faster 
and more accurately than we can with our crude little experiment here. We 
hope that you have learned a little about the inner workings of the disk 
drive. Don't be afraid to experiment; try moving the head to various tracks. 
If you go too far the drive may have to be initialized. Just don't perform 
too many 'BUMPS' and you should not experience any problems. Be sure to 
remove the cover of your drive so that you may see the the Reed/Write head 
move to these 'exotic' locations. 

. SPECIAL NOTICE TO ALL OF OUR CUSTOMERS . 

IT HAS COME TO OUR ATTENTION THAT DATAMOST INC. HAS APPARENTLY FILED FOR 
BANKRUPCY!! 

As most of you know DATAMOST INC publ1 shed/distributed the book INSIDE 
COMMODORE DOS by Richard Immers and Gerald Nuefeld. Unfortunatly, our supply 
of these books has 'dried up'. We have not been able to obtain any of these 
fine books since early December, despite DATAMOST's continued promises of 
'TWO to THREE WEEKS' delivery. Our apologies to our customers for any 
inconvenience that the undue delay in delivery ray have caused. If any 
customer of ours can find this book, BUY ITl If you have an order pending 
with us, just give us a call and we will cance1 your order and fully refund 
any monies that we have received from you. If anyone should wish to cancel 
their order, please give us a call. We are trying to obtain this book through 
ether sources. Some books are supposed to be available from RESTON Publishing 
at 1 - 800-336-0338. Give them a call, you may have luck in obtaining this 
excel lent book. 
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ALL ITEMS IN STOCK FOR IHHEDIATE SHIF^ENT 

PROGRAM PROTECTION MANUAL FOR THE C-64 (VOLUME II' S34.95 

THIS MANUAL BEGINS WHERE THE FIRST ENDED. COVERS THE LATEST ADVANCES 

IN PROGRAM PROTECTION, INCLUDING ENCRYPTION. GCR CODING, UNDOCUMENTED 
OPCODES, ADVANCED CARTRIDGE PROTECTION SCHEMES, AND MUCH MORE. 

1541 DISK DRIVE ALIGNMENT PROGRAM S44.95 

See Oct. 84 Coi»pute! Gazette for review 

PROGRAM PPOTE'-TION MANUAL FOR THE C-e,4 29.9' 

PROGRAM PROTECTION NEWSLETTER 35.00 

A monthly newsletter covering program protection. 3 to 5 different 
program protection schemes will be covered each month. A new section on 
the DOS and other special interests will also be included. 

CARDO 5 SLOT EXPANSION BOARD FOR THE C-64 60.00 

INCLUDES A RESET BUTTON AND THE CARTRIDGE SWITCH 

ADVANCED ML BOOK FOP THE C-64 (ABACUS^ 19.95 

ANATOMY OF THE 64 (ABACUS) 19.95 

ANATOMY OF THE 1541 •• i9.95 

MACHINE LANGUAGE BOOK OF THE 64 " 14.35 

TRICKS AND TIPS FOR THE 64 " 19.95 

INSIDE COMMODORE DCS <DATAMOS"" • NOT AVAILABLE AT THIS TIME 

1541 MAINTENANCE MANUAL (GOSUP) 29.9'=- 

PROMEMADE 99.50 

THIS IS THE EPROM PROGRAMMER THAI WE USE HERE!! USE IT TO MAKE YOUR 
OWN OPERATING SYSTEM CHIPS, CARTRIDGE PROGRAMS OP A NEW DOS FOR THE DISK 
DRIVE. SOFTWARE INCLUDED ON DISKETTE. 

DATA ERASE S34.95 

This will erase all U.V. erasable EPROMS. A compact and easy to 'ise 
■ jnit that will erase 2 EPPOMs in 15 min-jtes or less. 

BOAPDS, SOCKETS AND EPROMS: 

PCC2 2 CHIP CARTRIDGE BOARD S6.95 

PCC4 4 CHIP BANK SWITCHED CARTRIDGE BOARD 19.95 

PCVH2 PLASTIC HOUSING FOR ABOVE BOARDS 2.95 

LP28 28 PIN SOCKET FOR EPROM .59 

ZIF28 ZERO INSERTION FORCE 28 PIN SOCKET 4.75 

2732 EPROM (USE IN CARTRIDGE 4K) 5.00 

2764 EPPOM (USE IN CARTRIDGE 8K OF IN DISK DRIVE W/AD) 7.50 

27128 EPROM (16 K ON ONE CHIP - USE IN PCC4) 19.95 

68764 8K PIN FOP PIN REPLACEMENT FOR ROM's 29.95 

AD USE THIS ADAPTER TO USE THE 2764 EPROM IN THE DISK 

DRIVE OP IN THE COMPUTER. IF YOU DON'T USE THE 
ADAPTER ISE 68764 EPPOM 8.95 

HE5M0N (R) ML MONITOR ON A CARTRIDGE. 25.00 

This version also includes a DOS WEDGE and PROMOS (PROMENADE^ 
software on the cartridge. 

DISKMAKEP BY EA?=Ty S43.50 

1 1 










CARTRIDGE BACKER ... ONLY FROM CSM 


S54.95 

• ■ • 


THIS WILL 'BACK UP' SSH OF ALL CARTRIDGES ON THE MARKET TODAY! IT WILL 
DOWN LOAD THE NEW VERSION OF THE PROGRAM TO DISK AND WRITE AN AUTO BOOT 
LOADER FOR IT. AS MANY AS TEN CARTRIDGES MAY BE STORED ON A DISK. IT 
WILL ALSO TELL YOU WHAT CODE IT CHANGED IN ORDER TO 'BACK UP' THEM. THE 
UNIT CONTAINS IMPROVED SOFTWARE THAT WILL ALLOW YOU BACK UP ALMOST 
EVERY^CARTRIDGE AVAILABLE. IT WILL ALSO BACK UP THE ELECTRONIC ARTS <R) 
DISK PROGRAMS AND DO MORE OF THEM THAN ANY OTHER PROGRAM ON THE MARKET. 
THE PROGRAM ALSO CONTAINS SUPER SAVER-DISK TO DISK AND DISK TO TAPE 
FILE COPYING. 

AS MOST OF YOU KNOW BEAR TECHNOLOGY WENT OUT OF BUSINESS ON NOV. 30, 

1984. THEY MADE THE CARTRIDGE CRACKER <TM) PROGRAM_ WE AT CSM 

SOFTWARE HAVE TAKEN THE BASIC PREMISE OF THIS PROGRAM AND MADE IT 
BETTER!!! NEW SOFTWARE, IMPROVED BOARD AND A COMPANY THAT YOU CAN 
DEPEND ON. THIS PROGRAM WILL ALLOW MORE CARTRIDGES AND MORE DISKS TO BE 
BACKED UP THAN ANY CARTRIDGE BACK UP PROGRAM. 

XETEC PRINTER INTERFACE 59.95 

THIS INTERFACE WILL TURN YOUR GEMINI, DELTA OR EPSON PRINTER INTO A 
CORRESPONDANCE QUALITY PRINTER!!! THIS FLYER WAS PRINTED ON A GEMINI 
lOX WITH A XETEC PRINTER INTERFACE IN THE CORRESPONDENCE MODE. 

THREE MINUTE COPY PROGRAM.OMNICLONE 35.00 

UN-PROTECTED AND FULLY DOCUMENTED. 

THIS WILL COPY THE DISK AND AUTOMATICALLY PLACE ERRORS 20,21,22,23,27 fi. 
29 ON THE DESTINATION DISK. THREE PASSES, THREE MINUTES. DON'T CONFUSE 
THIS PROGRAM WITH SPEED COPY (GERMAN COPY PROGRAM) THAT ONLY DOES ERROR 
23, THIS DOES THEM ALL. FULL DOCUMENTATION IS INCLUDED SO THAT YOU CAN 
HAKE THIS THE BEST COPY PROGRAM OF ALL. LEARN ABOUT HALF TRACKING, HIGH 
SPEED DATA TRANSFER AND MUCH, MUCH MORE... 

ALL ITEMS PLUS SHIPPING. »2.50 US on ■o»t it«»a. »8.00 for MSD dual 

DISK DRIVE BELT-- post paid in th® US ^ Canada SIO.OO 

This is the belt that spins the disk. 


PROGRAM PROTECTION MANUAL -- VOLUME II (AVAILABLE FEB. 15) S34.95 


THIS MANUAL STARTS WHERE THE FIRST LEFT OFF... AN FULL INTRODUCTION TO 
MACHINE language, RESETS, INTERRUPTS AND AUTO BOOTS. IT ALSO COVERS THE 
MOST RECENT ADVANCES IN PROGRAM PROTECTION. HALF TRACKS, EXTRA TRACKS 
AND SECTORS, NON-STANDARD FORMATS, NIBBLE COUNTING, TRACK ARCING, 
UNIMPLIMENTED OPCODES, ENCRIPTION TECHNIQUES AND MUCH, MUCH MORE!!! 
EXPERTS HAVE AGREED TO CONTRIBUTE SELECTED CHAPTERS IN THEIR OWN FIELD 
OF EXPERTISE. THE INFORMATION IS PRESENTED IN AN EASY TO UNDERSTAND 
FASHION FOR THE BEGINNERS AND EXPERTS ALIKE. SAMPLE PROGRAMS ARE 
INCLUDED TO HELP YOU UNDERSTAND ALL THE PRINCIPLES. 


C.S.M. SOFTWARE INC. 
P. 0. BOX 563 
CROWN POINT, IN. 46307 
219-663-4335 







